diff --git a/pyproject.toml b/pyproject.toml
index db96fee..5e6bb05 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ license = { text = "Apache-2.0" }
 
 dependencies = [
   "fastapi==0.141.1",
-  "uvicorn[standard]==0.52.1",
+  "uvicorn[standard]==0.52.4",
   "pydantic==2.13.4",
   "pydantic-settings==2.15.0",
   "SQLAlchemy==2.0.52",
@@ -20,7 +20,7 @@ dependencies = [
   # `deploy/open-observatory-refine.service`. Dependabot proposed 2.5.2
   # because nothing declares that constraint at the top level; this comment
   # and the pin are the constraint.
-  "numpy==2.4.6",
+  "numpy==2.5.2",
   "soundfile==0.14.0",
   "typer==0.27.1",
   # Pinned, not left to typer's own `click>=8.0.0` range. click 8.2 changed
@@ -29,7 +29,7 @@ dependencies = [
   # `oo ... --help` die with a TypeError before printing anything. Found on
   # 2026-08-08 with click 8.4.2 -- on this laptop AND on the live station, so
   # the operator CLI documented in HANDOVER.md was already broken there.
-  "click==8.4.2",
+  "click==8.5.0",
   "rich==15.0.0",
   "structlog==26.1.0",
   "prometheus-client==0.26.0",
@@ -49,7 +49,7 @@ dependencies = [
 # ALSA capture on the target device.
 alsa = ["pyalsaaudio==0.11.0"]
 # Preferred high-quality polyphase resampler. Falls back to scipy when absent.
-resample = ["soxr==1.1.0", "scipy==1.18.0"]
+resample = ["soxr==1.1.0", "scipy==1.18.1"]
 # TFLite inference for the BirdNET adapter. `tflite-runtime` has no cp312
 # aarch64 wheel; ai-edge-litert is its maintained successor and does.
 birdnet = ["ai-edge-litert==2.2.0"]
@@ -59,16 +59,16 @@ dev = [
   "pytest==9.1.1",
   "pytest-asyncio==1.4.0",
   "httpx==0.28.1",
-  "ruff==0.16.2",
-  "mypy==2.3.0",
+  "ruff==0.16.4",
+  "mypy==2.3.1",
   # Validates real emitted events against schemas/detection-event.schema.json
   # (tests/test_mqtt_schema.py) so the envelope cannot drift unnoticed again.
   "jsonschema==4.26.0",
-  "hypothesis==6.165.5",
+  "hypothesis==6.165.10",
   # Client for scripts/probe_display_channel.py, which measures what
   # /api/v1/display actually costs on the wire against a real station (ADR-038).
   # Not a runtime dependency: the server side is Starlette's own WebSocket.
-  "websockets==17.0.1",
+  "websockets==17.1",
   # scripts/serial_capture.py. `pio device monitor` needs a tty, which an agent
   # or a CI job does not have, and reading the display's serial output is the
   # only evidence that the firmware works.